Exploit Validation

Every finding
proven before you see it

Active, multi-stage exploitation, re-reviewed against its own evidence. Fixes have to prove themselves too.

Fewer findings, and every one of them real

What reaches your teamShare of raw scanner outputProof

Nullify

exploit

Reachability filter

call graph

Raw scanner

signature

100+

findings validated
for exploitability

2×

every exploit reviewed twice
before it reaches you

A scan tells you what was true.
Nullify tells you what is true.

Your code, cloud and policy change every day. Nullify re-checks every finding against them, and every answer names the evidence it came from.

Scan reportStale

A scan is built once.

Accurate on the day it ran.

Last checked 14 days ago

Auth bypass · /api/sessionunverified

IDOR · /orders/{id}unverified

SSRF · /fetchunverified

XSS · /searchunverified

NullifyLive

Nullify re-checks continuously.

Updated by the work itself.

Last checked just now

Auth bypass · /api/sessionExploited

IDOR · /orders/{id}Exploited

SSRF · /fetchNot reachable

XSS · /searchSuppressed · sanitised

Is the auth bypass on /api/session actually exploitable?

Yes. The endpoint issues an admin session for an unsigned role claim. A second reviewer reproduced it from the evidence alone.

Sources

Assessment traceRequest/responseVideoRe-review

assessment / auth-bypass · replayread · just now

Move from noisy finding lists
to proven, merge-ready fixes

Exploit

Proves before it reports

Chains requests and application logic the way an attacker would, informed by your code, dependencies and cloud.

Assessment steps · live

Testing whether the role claim is ever verified…

POST /api/session {"role":"admin","sig":null}

200 OK admin session issued

Pivoting to payout endpoints with the forged session…

Second review

✓Verdict holds. Reproduced from evidence alone.

$ ./reproduce-exploit.sh

replaying 3 requests from evidence…
step 2/3 · 200 OK · role=admin
reproduced ✓ · attached to NFY-2214

Re-review

Checked a second time

Every exploit is replayed from its own evidence before it counts. A re-review pass, not a single agent's word.

Proof, stacked

Each step leaves something behind the next one can check. By the time a fix reaches your team, three layers of proof sit underneath it.

01

Suspect

02

Exploit

03

Re-review

0400:36

Fix proven

The exploit is replayed against the patch before the pull request opens. Plausible isn’t enough.

OpenVerify signed role claims · #1284

- trust(claims.role)

+ verify(claims, key).role

exploit replay → 401 Unauthorized ✓

Three layers of proof attachedMerge-ready

Proof lands where your team already works

Launch from the console, the CLI or a GitHub Action. Evidence shows up in the pull request and the escalation thread, not a separate dashboard.

Terminal · nullify CLI

$ nullify pentest run --target payments-api
→ mapping 214 routes · 38 in scope
→ exploiting POST /api/session … 200 OK · role=admin

Slack · #security-escalations

Nullify9:14 AM

Exploit confirmed and re-reviewed on payments-api. Fix #1284 replayed clean.

Pull request · evidence attached

Openacme/payments-api #1284

Verify signed role claims

nullify opened this PR

The session endpoint issued admin sessions from an unsigned role claim. Reproduction below; the patch makes it return 401.

req/resscreenshotvideo

›_ Exploit reproductionrepro.sh

1  curl -s -X POST $HOST/api/session \
2    -d '{"role":"admin","sig":null}' -c jar
3  # → 200 OK · role=admin
4  curl -s -b jar $HOST/admin/payouts
5  # → 200 OK · 14 payout records
6  # after #1284 → 401 Unauthorized ✓

A scanner says something might be wrong, while Nullify shows you it is and that the fix works

Exploit the path

Active, multi-stage exploitation informed by your code, dependencies and cloud — not a signature match.

Collect the evidence

Re-review it independently

Prove the fix

Pentest · payments-apiRunning

FindingExploitedRe-reviewFix

Auth bypass · /api/sessionyes✓ holds✓ #1284

IDOR · /api/orders/:idyes✓ holdsdrafting

Mass assignment · /usersno——

SSRF · /webhooks/testtesting…——

Works with

Proof across the whole program

$ nullify pentest run
→ 38 routes in scope · 4 exploited
→ evidence attached

AI Pentest Agent

Continuous, multi-stage testing of REST and GraphQL APIs.

Triage queue

✓ High · 4,545 kept · ranked

Low · noise · 36,364 suppressed

Triage & Remediation

Prioritize proven findings, then ship fixes driven to merge.

FAQ

Questions teams ask about exploit validation

Read the docs · AI Pentest Agent · Triage & Remediation

What does "exploit validation" actually mean?

+

For in-scope pentest findings, exploit validation means a finding is reported with reproducible exploit evidence. Nullify then scores impact against your business context, prepares a fix, and manages the pull request through review until your team merges it.

How is this different from a CVSS score or a scanner's severity rating?

+

A CVSS score estimates theoretical impact. For in-scope REST and GraphQL pentest findings, Nullify actively tests the path and provides reproducible evidence of what was exploited.

What evidence do we actually get?

+

Request/response pairs, screenshots and video for anything the pentest agent exploits, plus a second, independent review of the exploit against its own evidence before it's reported. It's built to be handed straight to a developer or an auditor, not re-verified by hand.

Does every finding get this same live-exploit treatment?

+

Live, evidence-backed exploitation is how Nullify's pentest agent validates REST and GraphQL API findings; SPA and SSR applications are covered through Bug Hunts, which promote confirmed exposure into a full pentest. Across all finding types, triage still checks reachability and exploitability before anything reaches a human — pentests are where that proof becomes a first-hand exploit.

Does exploit validation apply to fixes, or just findings?

+

Both, with evidence appropriate to each stage. Pentest findings carry reproducible exploit evidence; proposed fixes are independently reviewed and validated against the build and relevant tests before a merge-ready pull request reaches your team.

Scoped honestly

Prove what's exploitable and lower your MTTR

The AI harness that finds, proves and fixes vulnerabilities, starting with the ones an attacker can reach.

Book a demo Read the Docs